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Abstract 


A  permutation  group  on  n  letters  may  always  be  represented  by  a 
small  set  of  generators,  even  though  its  size  may  be  exponential  in  n. 
We  show  that  it  is  practical  to  use  such  a  representation  since  many 
problems  such  as  membership  testing,  equality  testing,  and  inclusion 
testing  are  decidable  in  polynomial  time.  In  addition,  we  demonstrate 
that  the  normal  closure  of  a  subgroup  can  be  computed  in  polynomial 
time,  and  that  this  procedure  can  be  used  to  test  a  group  for  solvabil¬ 
ity.  We  also  describe  an  approach  to  computing  the  intersection  of  two 
groups.  The  procedures  and  techniques  have  wide  applicability  and  have 


recently  been  used  to  improve  many  graph  isomorphism  algorithms. 
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Let  gj . be  permutations  of  the  set  {l,...,n}.  The  collection 

of  permutations  expressible  as  finite  compositions  of  these  g^  forms  a 
group;  a  group  whose  size  may  easily  be  exponential  in  n  and  k.  For 
example*  take  the  set  Sn  of  all  n!  permutations.  It  can  be  generated  by 
just  two  permutations,  a  cyclic  shift  of  the  n  letters,  and  a  transposi¬ 
tion  of  the  letters  1  and  2.  In  fact,  every  subgroup  G  of  Sn  can  be 
represented  succinctly  by  0(log|G|)  generators. 

It  is  natural  to  ask,  from  a  computational  perspective,  whether 
using  such  a  short  representation  of  such  a  large  collection  is  practi¬ 
cal.  More  to  the  point,  is  it  possible  to  answer  basic  questions  about 
a  group  G  that  is  defined  by  a  list  of  generators?  For  example,  can 
membership  be  tested?  can  the  size  be  determined?  can  two  groups  be 
tested  for  equality?  can  one  be  shown  to  include  the  other?  We  provide 
positive  answers  to  each  of  these  questions  in  the  form  of  polynomial¬ 
time  algorithms.  Classical  algorithms  to  solve  these  problems  have  been 
known  to  computational  group  theorists  for  soma  time,  but  without  accu¬ 
rate  analyses  of  running  times  [3,73. 

Permutation  groups,  depending  upon  how  they  are  represented,  either 
have  polynomial- time  membership  tests,  or  they  don’t.  Those  that  do  we 
call  polynomial- time  recognizable.  Any  group  represented  by  generators 
is  polynomial-time  recognizable.  The  automorphism  group  of  a  graph  is 
also  polynomial-time  recognizable,  even  if  generators  for  it  are  unk¬ 
nown,  since  testing  whether  a  permutation  is  an  automorphism  is  easy. 
As  an  important  corollary  we  will  prove  that  given  generators  for  a 
group  G,  generators  for  any  polynomial-time  recognizable  subgroup  with 
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small  index  can  be  found  in  polynomial  time. 

Using  these  techniques,  in  [4]  L.  Babai's  probabilistic 
polynomial- time  isomorphism  test  for  graphs  of  bounded  color  multipli¬ 
city  C2]  was  improved  to  deterministic  polynomial  time,  C.  Hoffmann’s 
probabilistic  0(nC^°^n)  isomorphism  test  for  cone  graphs  was  improved  to 
deterministic  0(nc^°^n)  time,  and  a  subexponential  algorithm  for 
trivalent  graph  isomorphism  was  described.  In  these  proceedings  £.  Luks 
[6]  shows  that  the  last  two  problems  are  decidable  in  deterministic 
polynomial  time.  Many  other  problems  of  permutation  groups  seem  to  have 
polynomial-time  solutions.  We  give  two  examples,  an  algorithm  for  com¬ 
puting  the  normal  closure  of  a  subgroup,  and  an  algorithm  to  test  a 
group  for  solvability.  In  addition,  we  describe  an  approach  to  the 
problem  of  computing  group  intersections. 

Preliminaries 

A  permutation  Simp  on  {l,.,.,n}  is  a  collection  of  1-1  maps  from 
{l,...,n}  onto  itself  that  forms  a  group  under  composition.  Let  G  be  a 
group.  The  order  Of  G,  |G|,  is  the  number  of  permutations  in  G.  Let  H 
be  a  subgroup  of  G,  written  G  ^  H.  The  quotient  symbol  G/H  stands  for 
the  collection  of  cosets  of  H  in  G,  i.e.,  the  collection  of  equivalence 
classes  of  elements  of  G  in  which  x  =  y  if  and  only  if  x  *y  is  in  H. 
From  Lagrange's  theorem  we  know  that  every  coset  of  G/H  has  the  same 
size  and,  therefore,  |G|  =  I  G/H  i  |H  1 .  The  size  of  G/H  is  called  the 
index  of  H  in  G. 

If  g^,...,g^  are  permutations,  then  the  group  <gj, . . ..  »gk>,  gen¬ 
erated  by  the  g^,  is  the  group  of  all  permutations  formed  by  products  of 


r 
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the  g^.  We  use  the  symbol  I  to  mean  the  unique  group  generated  by  the 
identity  permutation. 

Testing  Membership  and  Determining  rh£.  Order  0. L  a.  Group 

Let  G  be  a  group  of  permutations  on  {l»...,'n}  generated  by 

g^,...,gk.  There  is  a  descending  chain  of  subgroups. 

G  =  Gq  m  Gj  m  =>  Gn  =  I»  from  G  to  the  identity  group,  in  which  G^  is 
the  subgroup  of  G  fixing  l,...,i.  Consider  the  quotients 

Gi^Gi+l*  fc,c  . n-1.  The  group  G  can  be  exPressed  as 

G  =  Gg  =  (Gq/G1)G1, 
or.  G  =  (GQ/G1)(G1/G2)...(Gn_1/Gn). 

Tuerefore.  any  element  g  in  G  can  be  written  in  the  form 

g  =  aoal*“an-l*  where  ai  an  of  Gi^Gi+l*  Intuitively  this 

says  that  any  permutation  in  G  can  be  realized  as  a  permutation  that 
moves  1  to  the  correct  place,  followed  by  a  permutation  that  fixes  1  and 

moves  2  lo  the  correct  place,  followed  by  a  permutation  that  fixes  1  and 

2  and  moves  3  to  the  correct  place,  etc.  The  collection  of  elements  in 

Gj/G^+j,  i=0,...,n-l,  are  called  strong  generators  for  G.  Our  first 

theorem  yields  an  algorithm,  like  the  one  proposed  by  Sims  [7],  that 

computes  coset  representative::  for  each  of  the  quotients  in  polynomial 

time. 

Theorem  1:  Let  G  be  a  group  generated  by  g^...»»g^.  Let  G^  be  the  sub¬ 
group  of  G  fixing  letters  l,...,i.  Coset  representatives  for  G^/G^+^, 
i=0,...»n-l  can  be  determined  in  polynomial  time. 


Proof ;  The  maximum  value  that  tG^/G^j  I  can  have  is  n  since  cosets  only 
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differ  by  where  they  map  the  letter  i+1.  We  will  construct  a  table  T 
with  n  rows*  labelled  0  to  n-1,  and  n  columns*  label  lea  1  to  n,  whose 
ith  row  is  a  set  of  right  coset  representatives  for  Gj/G^j.  The  table 
will  be  organized  in  such  a  way  that  the  permutation  in  the  i»jth  posi¬ 
tion  fixes  letters  l,...,i-l  and  maps  letter  i  to  position  j.  Thus  the 

% 

entries  in  T  will  only  lie  on  or  above  the  diagonal. 

When  we  are  finished,  the  table  should  have  the  property  that  g  is 
in  G  if  and  only  if  g  can  be  expressed  as  aoai***ar-l*  w^ere  ai  a 
member  of  the  ith  row.  This  we  will  call  the  canonical  representation 
of  g. 


To  start,  initialize  T  with  the  diagonal  elements  equal  to  the 
identity  and  all  others  empty.  The  procedure  sift(x),  defined  below, 
modifies  the  table  by  inserting  at  most  one  new  coset  representative  in 
such  a  way  that  x  can  be  written  in  canonical  form. 

sift(x) : 
i  +•  0 

while  (i  X  n-1  and 

there  is  a  y  in  row  i  such  that 
y  and  x  map  i+1  to  the  same  letter) 

4a 

i  ijJ  1 
x  +-  y  x 

if.  x  is  not  a  member  if  row  i 
then  insert  x  in  row  i 

As  an  example  of  how  sift  works,  suppose  the  table  for  the  tower 
Gq  °  ^1  3  G2  3  ^3  =  *  at  soime  P°i-nt  looks  like  Figure  1. 


(Gn=)  | 

1 

1  Gl  +  1  a 

_|  G,  +  | 

.  .1  G 

(G, =)  | 

1 

.1  G.  +  1 

1 

J  6,  +  1 

1  G 

1 

<c2=)  |_ 

_J _ 

2  —  " 

ICj  +  1 

2 

J  G,  +  |_ 

1  G. 

Figure  1 
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Consider  the  call  sift(b)  for  some  b  in  Gg  but  not  in  G^.  If  a~*b 
is  in  Gj,  and  a  ^b  is  not  in  G^»  then  after  the  call  sift(b)  the  table 
would  look  like  Figure  2.  In  this  table  b  is  expressible  in  canonical 
form  as  a(a  1 b )  1 . 

I _ 1 _ I  I-  a_  I  I _ | 

I _ 1 _ I  I _ a_1b _ |  | _ | 

I _ 1 _ I  I _ I  I _ I 

Figure  2 

At  this  point  we  make  a  key  observation:  all  of  the  coset  represen¬ 
tatives  have  been  found  if  and  only  if 

(1)  each  generator  can  be  written  in  canonical  form,  and 

(2)  each  product  of  a  pair  of  representatives  in  the  table  can  be 
written  in  canonical  form. 

Since  we  will  only  sift  elements  from  G  we  need  only  verify  that 
when  (1)  and  (2)  are  satisfied  any  g  in  G  can  be  written  in  the  canoni¬ 
cal  form.  Let  g  be  an  element  of  G.  Write  g  as  a  product  of  generators 
and  write  each  generator  in  canonical  form.  If  this  product  is  not  in 
canonical  form,  use  (2)  to  rewrite  it. 

By  using  (2)  we  can  take  an  adjacent  pair  of  representatives  x,y  in 
the  string  representing  g  and,  if  x  comes  from  a  higher  numbered  row 
than  y,  rewrite  xy  in  canonical  form.  This  has  the  effect  of  moving  an 


* 
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element  from  a "lower  numbered  row  past  an  element  of  a  higher  numbered 
row  to  the  left  in  the  string  representing  g.  Moving  all  the  row  0 
representatives  to  the  left,  then  all  the  row  1  representatives,  and  so 
on,  we  can  put  the  string  in  canonical  form.  It  is  important  to  note 
here  that  writing  xy  in  canonical  form  does  not  require  the  introduction 
of  any  elements  from  lower  numbered  rows  than  the  one  y  comes  from. 

The  whole  algorithm  can  be  described  as 

Step  1.  Sift  all  the  generators. 

Step  2.  Close  the  table  such  that  the  product  xy,  for  every  pair 
(x,y)  in  the  table,  can  be  written  in  canonical  form. 

To  perform  Step  2  simply  run  through  all  pairs  (x,y)  from  the  table 

and  sift  their  product.  The  number  of  coset  representatives  in  the 

2  2  2 
table  is  at  most  n  .  The  number  of  calls  to  sift  is  at  most  (n  )(n  ) 

7 

and  each  call  to  sift  takes  roughly  n  time.  Therefore,  the  running 
time  is  O(n^),  a  polynomial  in  n. 

□ 

Once  the  coset  representatives  have  been  found,  testing  manbership 
and  computing  the  size  of  G  is  not  hard.  To  determine  if  x  is  an  ele¬ 
ment  of  G,  run  sift  with  argument  x.  If  x  can  be  written  in  canonical 
form  without  the  introduction  of  new  elements  into  the  table,  then  x  has 
can  be  written  as  a  product  of  generators.  If  x  cannot  be  written  in 
canonical  form,  then  x  is  not  in  G.  The  order  of  G  is  the  product  of 
the  sizes  of  G^/G^j. 

The  group  G  =  <g^,...,g^>  contains  H  =  <h2*...»hs>  if  and  only  if 


each  h^  is  a  member  of  G.  Two  groups  are  equal  if  and  only  if  each  con¬ 
tains  the  other.  Therefore,  the  polynomial-time  membership  test  gives 
polynomial-time  inclusion  and  equality  tests  for  permutation  groups. 

The  following  important  corollary  to  Theorem  1  is  used  by  E;  Luks 
[6]  in  his  polynomial- time,  bounded-valence  graph  isomorphism  test. 

Corollary  1:  Let  G  be  a  permutation  group  on  {l,...,n}  generated  by 
gj,...,g^.  Let  H  be  a  polynomial-time  recognizable  subgroup  of  G,  whose 
index  in  G  is  at  most  a  polynomial  in  n.  Generators  for  H  can  be  found 
in  polynomial  time. 

Proof i  The  sequence  of  groups  where  is  the 
subgroup  of  H  that  fixes  the  letters  l,...,i,  can  be  used  just  as  the 
sequence  G  3  Gj  3  •••  m  was  used  in  Theorem  1,  with  two  changes.  The 
first  is  that  row  0  may  have  a  polynomial  number  of  entries  instead  of 
at  most  n.  The  second  is  that  to  test  whether  two  elements  x  and  y  of  G 
are  in  different  cosets  of  G/H,  the  permutation  x  ^y  has  to  be  tested 
for  membership  in  H. 

□ 


Strai ght-Line  Programs 

By  a  straight  1  i  np  program  we  mean  a  sequence  of  instructions 

h, ... .»h  in  which 
1  m 


hi  = 


hjhj,  with  j,k  <  i,  or 


gj.  where  gj  is  a  generator. 


Not  every  permutation  x  in  G  can  necessarily  be  expressed  by  a 
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polynomial-length  word  in  the  g^«  however,  our  next  theorem  states  that 
every  x  can  be  expressed  as  the  result  of  a  short  straight-line  progran. 

The  or  nm  X.'  Let  G  =  be  a  group  of  permutations  on  {l,...,n}. 
There  is  a  polynomial  p  such  that  each  permutation  x  in  G  can  be  com¬ 
puted  by  a  straight-line  program  h^,...,hm  =  x,  where  m  £  p(n). 

Proof :  Using  the  polynomial- time  procedure  of  Theorem  1,  compute  a  table 
of  strong  generators  for  G.  Before  the  algorithm  begins,  form  a 
directed  acyclic  graph  with  k  leaves,  one  for  each  of  the  generators, 
and  no  edges.  As  the  table  is  built,  new  products  are  formed.  Each 
time  a  product  is  formed,  add  a  new  node  to  the  dag  in  such  a  way  that 
the  sons  of  this  node  correspond  to  the  factors  of  the  product. 

When  the  procedure  terminates',  a  polynomial-size  dag  will  have  been 
formed  and  every  permutation  represented  by  a  node  in  the  graph  will 
have  an  obvious  polynomial-length  straight-line  program  to  compute  it. 
Since  each  permutation  in  G  is  the  product  of  exactly  n  strong  genera¬ 
tors,  each  can  be  computed  by  a  polynomial-length  straight-line  program. 

□ 


group.- lhe.ar. e tig.  Applications 

Let  H  be  a  subgroup  of  a  permutation  group  G  on  {l,...,n}.  H  is 
Uoraal  in  G  if  g  *Hg  =  H  for  any  g  in  G.  The  normal  closure  of  H  in  G 
is  the  smallest  normal  subgroup,  K,  of  G  that  contains  H.  To  illustrate 
the  usefulness  of  the  sift  and  close  operations  we  present  a 
polynomial- time  algorithm  to  compute  generators  for  the  normal  closure 


of  H  in  G 
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Theorem  1:  Let ‘H  =  <hj . hr>  be  a  subgroup  of  G  =  <gj,...,gk>.  Gen¬ 
erators  for  K,  the  normal  closure  of  H  in  G,  can  be  computed  in  polyno¬ 
mial  time. 

Proof:  Form  a  table  T  of  strong  generators  for  H  using  the  algorithm  of 
Theorem  1.  In  order  to  get  generators  for  K  we  will  modify  T  until  it 
is  a  table  of  strong  generators  for  K. 

Since  H  is  a  subset  of  K,  and  K  is  normal  in  G,  each  product  of  the 
form  g^hg^,  where  g^  is  a  generator  of  G  and  h  is  a  coset  representa¬ 
tive  from  T,  should  be  m  K.  In  order  to  achieve  this  we  will  take 
every  such  product  and  sift  it  into  T.  The  following  program  takes  T 
and  augments  it  using  the  sift  and  close  steps  until  T  has  the  property 
that  for  all  h  in  T,  and  for  all  generators  g^  of  G,  the  product  g^hg^ 
is  expressible  in  canonical  form  using  representatives  of  T. 

while  there  is  an  x  in  T 

not  processed  by  this  loop 

for  each  g . :  sift(g.  xg . ) 
close  T  1  1  X 

The  main  loop  is  executed  at  most  a  polynomial  number  of  times. 
Since  sifting  and  closing  are  polynomial-time  operations*  the  whole  pro¬ 
gram  runs  in  polynomial  time. 

Let  Group(T)  stand  for  the  group  generated  by  the  permutations  in 
the  table  T.  Certainly  Group(T)  contains  H.  A  simple  induction  proves 
that  the  T  produced  by  the  above  algorithm  contains  only  permutations 
that  are  generated  from  products  of  the  form  x  or  g^xg^  where  x  is  an 
element  of  the  normal  closure  of  H  in  G.  Therefore,  if  Group(T)  is  nor¬ 
mal  in  G,  then  it  is  the  smallest  normal  subgroup  of  G  that  contains  H. 
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To  see  that  Group(T)  is  normal  in  G,  observe  that  for  each  genera¬ 
tor  of  G,  and  each  generator  x  of  Group(T),  the  product  g^xg^  is  in 
Group(T).  Let  x^,...,xm  be  some  of  the  generators  of  Group(T).  For 
each  generator  g^  of  G,  define  x^  to  be  g^x^g^,  an  element  of  Group(T). 
If  y  =  x^X2...xm,  then 

-1  -1 
gi  yg£  =  gi  x1...xmgi 

=  xlg:1x2...xingi 

•  1  -1 

=  xl***xm&i  8i 

t  • 

=  Xi***xm,  an  element  of  Group(T). 


It  is  not  hard  to  see  from  this  that  if  g  is  any  element  of  G  and  y  is 
any  element  of  Group(T),  then  g  ^yg  is  an  element  of  Group(T).  There¬ 
fore,  Group(T)  is  the  normal  closure  of  H  in  G. 

□ 


The  derived  subgroup  G*  of  a  group  G  is  defined  to  be  the  group 
generated  by  all  products  of  the  form  a  *b  *ab,  where  a,b  are  elements 
of  G.  The  group  G  is  called  solvable  if  the  sequence 
G  s  G'  terminates  at  I.  Solvable  groups  play  an  impor¬ 

tant  role  in  the  study  of  field  extensions  and  ultimately  relate  to  the 
conditions  under  which  a  polynomial  equation  has  a  solution  in  radicals. 
Using  the  normal  closure  algorithm  we  can  get  a  polynomial-time  test  for 
solvability. 

Theorem  4:  Let  G  =  <gj,...,g^>  be  a  group  of  permutations  on  {1 . n}. 

In  polynomial  time  G  can  be  tested  for  solvability. 

Proof :  It  is  a  fact,  which  wc  don't  prove  here,  that  the  derived  sub¬ 
group  of  G  is  equal  to  the  normal  closure  in  G  of  the  subgroup  generated 


-  12  - 


by  all  products  of  the  form  g^gj^g^gj.  By  forming  all  such  products, 
and  computing  the  normal  closure,  the  derived  subgroup  of  G  can  be  com- 
puted  in  polynomial  time. 

If  the  sequence  Go  G'  =>•••  converges  to  I,  then  it  does  so  within 
a  polynomial  number  of  steps,  since  |G^Vg^+^|  2  2.  If  tfie  sequence 
doesn't  converge  to  I,  then  for  some  polynanially  bounded  i, 
^  =  G^+^.  The  derived  groups  can  be  computed,  and  group  equality 
can  be  tested  in  polynomial  time.  Therefore,  it  can  be  determined,  in 
polynomial  time,  whether  the  sequence  converges  to  I.  Hence,  G  can  be 
tested  for  solvability  in  polynomial  time. 

□ 


Ihe.  Intersection  Problem 

In  [4],  [5],  and  [6]  a  relationship  has  been  established  between 
certain  graph  isomorphism  problems  and  the  problem  of  computing  genera¬ 
tors  for  the  intersection  of  two  groups.  Given  an  arbitrary  pair  of 
groups,  G=<gj, . .  .,gjc>,  and  H=<h^ , . . . ,hf>  we  do  not  know  whether  it  is 
possible  to  compute  generators  for  their  intersection  quickly.  There 
are,  however,  certain  situations  in  which  the  intersection  can  be  found 
in  polynomial  time. 

Polynomial  lv  AcCeSS-iMe  Tcwers 

The  theorem  proved  in  section  1  that  computes  coset  representatives 
for  the  quotient  groups  G^/G^+j  relies  on  four  properties  of  the  tower 
G0  D  ...  3  Gr  =  I  for  its  polynomial  running  time.  They  are 
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(  i)the  number  of  groupe  is  polynomial  in  n, 

(  ii)generators  for  Gq  are  known, 

(iii)the  size  of  Gj/G^+^  is  bounded  by  a  polynomial  in  n,  and 

(  iv)there  is  a  polynomial-time  test  to  determine  if  a  and  b  from 
are  from  the  same  coset  of  G^/G^^. 

Any  tower  that  satisfies  these  four  conditions  we  call  polynomially 
accessible.  Using  this  definition  we  can  restate  the  first  theorem. 

Theorem  5.:  Let  =  •••  »  G  =  1  be  a  polynomially  accessible  tower  of 
groups.  Coset  representatives  for  the  quotients  G^/G^+j,  for 

i=0,...,r-l,  can  be  determined  in  polynomial  time. 

This  allows  us  to  prove  the  main  theorem  of  this  section. 

Theorem  A:  Let  G  and  H  be  any  two  polynomial- time  recognizable  groups. 
Let  S  be  a  group  for  which  generators  are  known.  If  S  contains  both  G 
and  H»  and  there  are  two  polynomially  accessible  towers,  one  from  S 
through  G  to  I,  and  the  other  from  S  through  H  to  I,  then  generators  for 
GnH  can  be  found  in  polynomial  time. 

Proof :  Let  S  =  HQ  3  •••  3  Hr  =  H  3  3  •••  =>  Hg_j  =  I,  and 

s  =  G0  3  •••  3  =  G  3  G^j  a  •••  =>  G^_j  =  I  be  the  two  towers.  Con¬ 
struct  an  s  x  q  table  whose  i.jth  entry  is  the  group  G^flHj.  Each  entry 
is  a  recognizable  group  since  it  is  the  intersection  of  recognizable 
groups. 

Both  llij/Hj4^|  and  IG^/G^jl  are  bounded  by  some  polynomial  p(n). 
Consider  the  two  groups  G^nilj  and  G^nHj+j.  Let  a  and  b  be  distinct 


coset  representatives  of  X  =  (G^H  jJ/fG^nH^).  The  elements  a  and  b 
are  both  from  the  group  H^.  Furthermore,  if  a  ^b  were  an  element  of 
Hj+j,  it  would  also  be  an  element  of  G^nHj+^.  Since  a  and  b  are  from 
different  cosets  of  X  it  follows  that  a  *b  is  not  in  Hj+j*  Therefore,  a 
and  b  are  distinct  coset  representatives  of  Hj/Hj+^.  Hence 
1  ( G^nH j ) / ( G^nH ^ )  |  is  less  than  or  equal  to  |Hj/H j+^  I  £  p(n).  Simi¬ 
larly,  | (GinHj)/(Gi+1nHj) I  £  p(n). 

Let  P  be  any  path  in  the  table  beginning  at  S,  moving  only  one  row 
down  or  one  column  across  at  a  time,  passing  through  GnH,  and  ending  at 
I*  This  path  P  describes  a  polyncmially  accessible  tower  of  groups  from 
S  through  GnH  to  I. 


For  example. 


the  tower  S  a  Hj  =  H2  =>  •••  =>  H  =>  G^H  o 


•••  a  G  nH  a  GnH  =  G  .,nH  m  •••  m  I  can  be  used  to  get  generators  for 

p  p+l 

GnH  in  polynomial  time. 


A  natural  conclusion  that  we  can  draw  from  this  theorem  is  that 
many  group  intersection  problems  lie  in  NPncoNP.  For  example,  this  will 
be  the  case  whenever  we  know  that  G  and  H 


(1)  lie  under  a  common  group  S,  and 

(2)  there  exists  a  chain  of  groups  between  S  and  G,  and  a  chain 
between  S  and  H  whose  indices  are  polynomially  bounded. 


The  reason  computing  GnH,  for  such  G  and  H,  is  in  NPncoNP  is  that  one 
can  use  nondeterminism  to  guess  generators  for  S  and  for  each  of  the 
groups  in  the  chains.  Towers  from  G  to  I,  and  from  H  to  I  can  be 


obtained  by  fixing  letters,  and  then  the  algorithm  in  Theorem  5  can  be 
used  to  verify  the  guesses. 
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